[flemzord]

Build and publish ghcr.io/formancehq/base with four tags: 22.04, 24.04, 26.04, and scratch, each for linux/amd64 and linux/arm64.

Parameterize the Ubuntu base and replace the two build steps with a four-entry matrix. Keep the nightly schedule at 04:30 UTC and the manual Run workflow trigger. Pull upstream images and disable layer caching so each run refreshes the installed packages and CA certificates.

The 22.04 tag currently contains Ubuntu 24.04. This change makes it use Ubuntu 22.04; consumers that need Ubuntu 24.04 should use the new 24.04 tag. The scratch image keeps Alpine CA certificates and Ubuntu 24.04 timezone data.

Validation:

• actionlint .github/workflows/cron.yml passed.
• Independent Codex review passed with no actionable findings.
• All four images built successfully with --pull --no-cache for both linux/amd64 and linux/arm64 (eight variants), loaded locally without publishing.
• Inspected all eight variants: Ubuntu release matches the tag, timezone data exists, and the CA bundles exclude the affected emSign G3 roots and AAA Certificate Services while retaining DigiCert Global Root G2.
• git diff --check passed.

The existing Docker warning about the reserved scratch stage name remains unchanged. No registry images were published during validation.